deepspace 0.5.5 → 0.5.7

package/dist/cli.js

@@ -2,15 +2,15 @@
 
 // src/cli/cli.ts
 import { defineCommand as defineCommand22, runMain } from "citty";
-import { execSync as execSync4 } from "child_process";
-import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
-import { dirname as dirname4, join as join16 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { spawnSync as spawnSync6 } from "child_process";
+import { readFileSync as readFileSync17, existsSync as existsSync14 } from "fs";
+import { dirname as dirname5, join as join15 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/cli/lib/cli-errors.ts
 var API_ERROR_HINTS = {
   not_app_owner: "Only the app owner can do this.",
-  app_not_found: "App not found. Check the app name (wrangler.toml `name`) and that it has been deployed.",
+  app_not_found: "App not found. Check the app id \u2014 the DEEPSPACE_APP_ID value in wrangler.toml, usually `app_\u2026` (a legacy app's id is its name). List your apps with `deepspace apps`. (`domain` commands take the deployed app *name* instead.)",
   not_app_owner_or_collaborator: "You must be the app owner or a collaborator to do this.",
   test_account_cannot_be_collaborator: "Test accounts cannot be added as collaborators. Use a real DeepSpace account.",
   user_not_found: "No DeepSpace user with that email. They need to log in to DeepSpace at least once (`deepspace login`, or sign in to any app) before they can be referenced by email."
@@ -25,8 +25,11 @@ ${hint}` : message;
 }
 function renderCliError(err) {
   console.error(formatCliError(err));
-  if (process.env.DEBUG && err instanceof Error && err.stack) {
-    console.error("\n" + err.stack);
+  if (process.env.DEBUG) {
+    const { apiPath, status: status3 } = err;
+    if (apiPath) console.error(`
+API ${apiPath}${status3 ? ` (${status3})` : ""}`);
+    if (err instanceof Error && err.stack) console.error("\n" + err.stack);
   }
   process.exit(1);
 }
@@ -51,7 +54,7 @@ function wrapCommandErrors(cmd) {
 
 // src/cli/commands/login.ts
 import { defineCommand } from "citty";
-import { writeFileSync as writeFileSync5, mkdirSync } from "fs";
+import { writeFileSync as writeFileSync5, mkdirSync, readFileSync as readFileSync4 } from "fs";
 import { join as join3 } from "path";
 import { homedir } from "os";
 import { randomBytes, createHash } from "crypto";
@@ -437,23 +440,56 @@ function parseSecretsUpload(content) {
     return out2;
   }
   const out = {};
-  for (const rawLine of trimmed.split("\n")) {
-    const line = rawLine.trim();
+  const lines = trimmed.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
     if (!line || line.startsWith("#")) continue;
     const eq = line.indexOf("=");
     if (eq <= 0) continue;
     const key = line.slice(0, eq).trim();
     if (!SECRET_NAME_RE.test(key)) continue;
     validateSecretName(key);
-    let value = line.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
-      value = unescapeDotenv(value.slice(1, -1));
+    const raw = line.slice(eq + 1).trim();
+    const quote = raw[0] === '"' || raw[0] === "'" ? raw[0] : null;
+    let value;
+    if (!quote) {
+      value = raw;
+    } else if (endsWithUnescapedQuote(raw.slice(1), quote)) {
+      const inner = raw.slice(1, -1);
+      value = quote === '"' ? unescapeDotenv(inner) : inner;
+    } else {
+      const startLine = i + 1;
+      const parts = [raw.slice(1)];
+      let closed = false;
+      while (++i < lines.length) {
+        const cont = lines[i].trimEnd();
+        if (endsWithUnescapedQuote(cont, quote)) {
+          parts.push(cont.slice(0, -1));
+          closed = true;
+          break;
+        }
+        parts.push(lines[i]);
+      }
+      if (!closed) {
+        throw new Error(
+          `Unterminated quoted value for "${key}" (opens on line ${startLine}). Close the ${quote === '"' ? "double" : "single"} quote, or escape newlines as \\n on one line.`
+        );
+      }
+      value = parts.join("\n");
+      if (quote === '"') value = unescapeDotenv(value);
     }
     validateSecretValue(key, value);
     out[key] = value;
   }
   return out;
 }
+function endsWithUnescapedQuote(s, q) {
+  if (!s.endsWith(q)) return false;
+  if (q === "'") return true;
+  let backslashes = 0;
+  for (let j = s.length - 2; j >= 0 && s[j] === "\\"; j--) backslashes++;
+  return backslashes % 2 === 0;
+}
 function unescapeDotenv(v) {
   let out = "";
   for (let i = 0; i < v.length; i++) {
@@ -1072,19 +1108,38 @@ var login_default = defineCommand({
   args: {
     email: {
       type: "string",
-      description: "Email address (non-interactive mode)",
+      description: "Email address (non-interactive mode; or $DEEPSPACE_EMAIL)",
       required: false
     },
     password: {
       type: "string",
-      description: "Password (non-interactive mode)",
+      description: "Password (discouraged \u2014 visible in ps/history; prefer --password-stdin or $DEEPSPACE_PASSWORD)",
       required: false
+    },
+    "password-stdin": {
+      type: "boolean",
+      description: "Read the password from stdin instead of --password",
+      default: false
     }
   },
   async run({ args }) {
-    if (args.email && args.password) {
-      console.log(`Signing in as ${args.email}...`);
-      await doEmailLogin(args.email, args.password);
+    const interactive = Boolean(process.stdin.isTTY);
+    const { email, password } = resolveLoginCredentials({
+      emailArg: args.email,
+      passwordArg: args.password,
+      envEmail: interactive ? void 0 : process.env.DEEPSPACE_EMAIL,
+      envPassword: interactive ? void 0 : process.env.DEEPSPACE_PASSWORD,
+      passwordStdin: args["password-stdin"] ? readPasswordFromStdin() : void 0
+    });
+    const passwordIntent = Boolean(args["password-stdin"]) || args.password !== void 0 || password !== void 0;
+    const decision = loginModeDecision({ email, password, passwordIntent });
+    if (decision.mode === "error") {
+      console.error(decision.message);
+      process.exit(1);
+    }
+    if (decision.mode === "password") {
+      console.log(`Signing in as ${email}...`);
+      await doEmailLogin(email, password);
       console.log("Logged in");
       return;
     }
@@ -1135,6 +1190,34 @@ plans on the web dashboard:
     p2.outro("Done");
   }
 });
+function resolveLoginCredentials(opts) {
+  const email = opts.emailArg || opts.envEmail || void 0;
+  const password = opts.passwordStdin !== void 0 ? opts.passwordStdin : opts.passwordArg || opts.envPassword || void 0;
+  return { email, password };
+}
+function loginModeDecision(opts) {
+  if (opts.email && opts.password) return { mode: "password" };
+  if (!opts.passwordIntent) return { mode: "oauth" };
+  if (!opts.email) {
+    return {
+      mode: "error",
+      message: "Non-interactive login needs an email: --email <you@example.com> (or $DEEPSPACE_EMAIL)."
+    };
+  }
+  return {
+    mode: "error",
+    message: "Non-interactive login needs a non-empty password: --password-stdin, $DEEPSPACE_PASSWORD, or --password."
+  };
+}
+function readPasswordFromStdin() {
+  if (process.stdin.isTTY) {
+    console.error(
+      '--password-stdin expects the password piped on stdin, e.g. `printf %s "$PW" | deepspace login --email you@x.com --password-stdin`.'
+    );
+    process.exit(1);
+  }
+  return readFileSync4(0, "utf-8").replace(/\r?\n$/, "");
+}
 async function pollForCompletion(sessionId, codeVerifier) {
   const maxAttempts = 120;
   const interval = 5e3;
@@ -1205,7 +1288,7 @@ async function doEmailLogin(email, password) {
 
 // src/cli/commands/logout.ts
 import { defineCommand as defineCommand2 } from "citty";
-import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync5, rmSync as rmSync2 } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 var AUTH_URL2 = process.env.DEEPSPACE_AUTH_URL ?? PLATFORM_URLS.auth;
@@ -1218,7 +1301,7 @@ var logout_default = defineCommand2({
     description: "Sign out and remove cached credentials"
   },
   async run() {
-    const sessionToken = existsSync4(SESSION_PATH) ? readFileSync4(SESSION_PATH, "utf-8").trim() : null;
+    const sessionToken = existsSync4(SESSION_PATH) ? readFileSync5(SESSION_PATH, "utf-8").trim() : null;
     if (sessionToken) {
       try {
         await fetch(`${AUTH_URL2}/api/auth/sign-out`, {
@@ -1248,11 +1331,11 @@ var logout_default = defineCommand2({
 
 // src/cli/commands/dev.ts
 import { defineCommand as defineCommand3 } from "citty";
-import { resolve as resolve4, basename, join as join9 } from "path";
+import { resolve as resolve4, basename as basename2, join as join9 } from "path";
 import spawn from "cross-spawn";
 
 // src/cli/auth.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync5, mkdirSync as mkdirSync2 } from "fs";
 import { join as join5 } from "path";
 import { homedir as homedir3 } from "os";
 
@@ -1272,7 +1355,7 @@ var SESSION_PATH2 = join5(DIR2, "session");
 var TOKEN_PATH2 = join5(DIR2, "token");
 async function ensureToken() {
   if (existsSync5(TOKEN_PATH2)) {
-    const existing = readFileSync5(TOKEN_PATH2, "utf-8").trim();
+    const existing = readFileSync6(TOKEN_PATH2, "utf-8").trim();
     if (isTokenValid(existing)) {
       return existing;
     }
@@ -1280,7 +1363,7 @@ async function ensureToken() {
   if (!existsSync5(SESSION_PATH2)) {
     throw new Error("Not logged in. Run `deepspace login` first.");
   }
-  const sessionToken = readFileSync5(SESSION_PATH2, "utf-8").trim();
+  const sessionToken = readFileSync6(SESSION_PATH2, "utf-8").trim();
   const token = await exchangeSession(AUTH_URL3, sessionToken);
   if (!token) {
     throw new Error("Session expired. Run `deepspace login` to re-authenticate.");
@@ -1301,20 +1384,56 @@ function isTokenValid(jwt) {
 // src/cli/lib/app-context.ts
 import {
   existsSync as existsSync6,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync,
   writeFileSync as writeFileSync7,
   mkdirSync as mkdirSync3,
   renameSync,
   unlinkSync
 } from "fs";
-import { join as join6, resolve as resolve2, dirname, isAbsolute, sep } from "path";
+import { join as join6, resolve as resolve2, dirname, basename, isAbsolute, sep } from "path";
 import { parse as parseToml3 } from "smol-toml";
+
+// src/cli/lib/api.ts
+var ApiError = class extends Error {
+  constructor(message, status3, code, apiPath) {
+    super(message);
+    this.status = status3;
+    this.code = code;
+    this.apiPath = apiPath;
+  }
+};
+async function apiFetch(baseUrl, token, path, init) {
+  const res = await fetch(`${baseUrl}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...init?.headers ?? {}
+    }
+  });
+  const text2 = await res.text();
+  if (!res.ok) {
+    let msg = text2;
+    let code;
+    try {
+      const body = JSON.parse(text2);
+      msg = body.error ?? text2;
+      code = body.code;
+    } catch {
+    }
+    throw new ApiError(msg || `Request failed (${res.status})`, res.status, code, path);
+  }
+  return text2 ? JSON.parse(text2) : {};
+}
+
+// src/cli/lib/app-context.ts
+var STRICT_APP_ID_RE = /^app_[0-9A-HJKMNP-TV-Z]{26}$/;
 function detectAppName(cwd = process.cwd()) {
   const wranglerPath = join6(resolve2(cwd), "wrangler.toml");
   if (!existsSync6(wranglerPath)) return null;
   try {
-    const cfg = parseToml3(readFileSync6(wranglerPath, "utf-8"));
+    const cfg = parseToml3(readFileSync7(wranglerPath, "utf-8"));
     return typeof cfg.name === "string" && cfg.name.length > 0 ? cfg.name : null;
   } catch (err) {
     throw new Error(
@@ -1363,18 +1482,42 @@ function writeLaunchFile(launchPath, config) {
 function readLaunchFile(launchPath) {
   const empty = { version: "0.0.1", configurations: [] };
   if (!existsSync6(launchPath)) return empty;
-  const raw = readFileSync6(launchPath, "utf-8").trim();
+  const raw = readFileSync7(launchPath, "utf-8").trim();
   if (!raw) return empty;
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.configurations)) return null;
   return parsed;
 }
-function writeLaunchConfigIfMissing(appDir, appName, port) {
+function writeLaunchConfigIfMissing(appDir, appName, port, opts = {}) {
   const launchPath = join6(appDir, ".claude", "launch.json");
   try {
     const config = readLaunchFile(launchPath);
     if (!config) return;
-    if (config.configurations.some((c) => c?.name === appName)) return;
+    const existing = config.configurations.find((c) => c?.name === appName);
+    if (existing) {
+      if (!opts.updatePort) return;
+      let changed = false;
+      if (Number(existing.port) !== port) {
+        existing.port = port;
+        changed = true;
+      }
+      if (Array.isArray(existing.runtimeArgs)) {
+        const ra = existing.runtimeArgs.map(String);
+        const pi = ra.indexOf("--port");
+        if (pi >= 0 && pi + 1 < ra.length) {
+          if (ra[pi + 1] !== String(port)) {
+            ra[pi + 1] = String(port);
+            changed = true;
+          }
+        } else {
+          ra.push("--port", String(port));
+          changed = true;
+        }
+        if (changed) existing.runtimeArgs = ra;
+      }
+      if (changed) writeLaunchFile(launchPath, config);
+      return;
+    }
     config.configurations.push({
       name: appName,
       runtimeExecutable: "npx",
@@ -1385,6 +1528,18 @@ function writeLaunchConfigIfMissing(appDir, appName, port) {
   } catch {
   }
 }
+function resolveAppLaunchPort(appDir) {
+  try {
+    const config = readLaunchFile(join6(appDir, ".claude", "launch.json"));
+    if (!config) return null;
+    const appName = detectAppName(appDir) ?? basename(appDir);
+    const entry = config.configurations.find((c) => c?.name === appName) ?? (config.configurations.length === 1 ? config.configurations[0] : void 0);
+    const port = Number(entry?.port);
+    return Number.isInteger(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
+}
 function detectClaudeWorktree(appDir) {
   const segments = resolve2(appDir).split(sep);
   for (let i = segments.length - 3; i >= 1; i--) {
@@ -1420,7 +1575,7 @@ function upsertWorktreeLaunchConfig(mainRepoRoot, worktreeName, appDir, opts) {
     let port = opts.port;
     if (opts.probePort) {
       const taken = new Set(
-        config.configurations.map((c) => Number(c?.port)).filter((p8) => Number.isInteger(p8) && p8 > 0)
+        config.configurations.map((c) => Number(c?.port)).filter((p10) => Number.isInteger(p10) && p10 > 0)
       );
       for (let i = 0; i < WORKTREE_PORT_RANGE && taken.has(port); i++) {
         port = WORKTREE_PORT_MIN + (port - WORKTREE_PORT_MIN + 1) % WORKTREE_PORT_RANGE;
@@ -1473,9 +1628,36 @@ function requireAppIdArg(explicit) {
   }
   return id;
 }
+function matchAppSelector(apps, selector) {
+  const byId = apps.find((a) => a.appId === selector);
+  if (byId) return byId.appId;
+  const byName = apps.find((a) => a.name === selector);
+  if (byName) return byName.appId;
+  return STRICT_APP_ID_RE.test(selector) ? selector : null;
+}
+async function resolveAppSelector(deployUrl, token, selector) {
+  if (STRICT_APP_ID_RE.test(selector)) return selector;
+  const { apps } = await apiFetch(deployUrl, token, "/api/apps");
+  const id = matchAppSelector(apps, selector);
+  if (!id) {
+    throw new Error(`No app "${selector}" in your account. Run \`deepspace apps\` to list your apps.`);
+  }
+  return id;
+}
+async function resolveAppTarget(deployUrl, token, explicit) {
+  if (explicit) return resolveAppSelector(deployUrl, token, explicit);
+  const appDir = findAppDir();
+  const id = appDir ? readAppId(appDir) : null;
+  if (!id) {
+    throw new Error(
+      "No app id. Run from an app directory whose wrangler.toml carries DEEPSPACE_APP_ID, or pass --app <id or name>."
+    );
+  }
+  return id;
+}
 
 // src/cli/lib/install-status.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
 import { join as join7 } from "path";
 function ensureInstallReady(appDir) {
   if (existsSync7(join7(appDir, "node_modules", "deepspace", "package.json"))) return;
@@ -1486,13 +1668,19 @@ function ensureInstallReady(appDir) {
   const logPath = join7(sentinelDir, "install.log");
   if (existsSync7(errPath)) {
     console.error("Background install failed:");
-    console.error(readFileSync7(errPath, "utf-8").trimEnd());
+    console.error(readFileSync8(errPath, "utf-8").trimEnd());
     if (existsSync7(logPath)) console.error(`
 Full log: ${logPath}`);
     console.error("\nRun `npm install` (or `bun install`) manually, then retry.");
     process.exit(1);
   }
   if (existsSync7(startedPath) && !existsSync7(donePath)) {
+    if (!installWorkerAlive(sentinelDir)) {
+      console.error("The background install is no longer running and never finished.");
+      if (existsSync7(logPath)) console.error(`See what happened: ${logPath}`);
+      console.error("Run `npm install` (or `bun install`) manually, then retry.");
+      process.exit(1);
+    }
     console.error("Dependencies are still installing in the background.");
     if (existsSync7(logPath)) console.error(`Tail progress: tail -f ${logPath}`);
     console.error("Retry once it finishes.");
@@ -1501,6 +1689,18 @@ Full log: ${logPath}`);
   console.error("Dependencies not installed. Run `npm install` (or `bun install`) first.");
   process.exit(1);
 }
+function installWorkerAlive(sentinelDir) {
+  const pidPath = join7(sentinelDir, "install.pid");
+  if (!existsSync7(pidPath)) return true;
+  const pid = Number.parseInt(readFileSync8(pidPath, "utf-8").trim(), 10);
+  if (!Number.isFinite(pid) || pid <= 0) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
 
 // src/cli/lib/preflight.ts
 import { execFileSync } from "child_process";
@@ -1578,7 +1778,16 @@ function removeMacosJunk(dir) {
 }
 
 // src/cli/lib/port.ts
+import { createServer } from "net";
 var DEFAULT_PORT = 5173;
+function checkPortAvailable(port, host = "0.0.0.0") {
+  return new Promise((resolve10) => {
+    const srv = createServer();
+    srv.once("error", () => resolve10(false));
+    srv.once("listening", () => srv.close(() => resolve10(true)));
+    srv.listen(port, host);
+  });
+}
 function resolvePort(arg) {
   const raw = arg ?? process.env.DEEPSPACE_PORT;
   if (!raw) return DEFAULT_PORT;
@@ -1605,6 +1814,7 @@ var dev_default = defineCommand3({
     },
     env: {
       type: "string",
+      alias: "e",
       description: "wrangler.toml [env.<name>] block to run (e.g. --env staging). Applies the env's overrides at build time.",
       required: false
     },
@@ -1662,7 +1872,9 @@ var dev_default = defineCommand3({
         );
       }
     }
-    writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename(appDir), port);
+    writeLaunchConfigIfMissing(appDir, detectAppName(appDir) ?? basename2(appDir), port, {
+      updatePort: explicitPort
+    });
     ensureInstallReady(appDir);
     let token;
     try {
@@ -1710,6 +1922,12 @@ var dev_default = defineCommand3({
       process.exit(1);
     }
     preflightWindowsWorkerd(appDir);
+    if (!await checkPortAvailable(port)) {
+      console.error(`Port ${port} is already in use.`);
+      const killCmd = port === DEFAULT_PORT ? "deepspace kill" : `deepspace kill --port ${port}`;
+      console.error(`Free it with \`${killCmd}\`, or start on another port: \`deepspace dev --port <other>\`.`);
+      process.exit(1);
+    }
     console.log("Starting dev server...\n");
     const vite = spawn("npx", ["vite", "--port", String(port), "--strictPort", "--host"], {
       cwd: appDir,
@@ -1732,10 +1950,16 @@ var dev_default = defineCommand3({
 // src/cli/commands/kill.ts
 import { defineCommand as defineCommand4 } from "citty";
 import { spawnSync } from "child_process";
-import { readFileSync as readFileSync8, readdirSync as readdirSync3, readlinkSync } from "fs";
+import { readFileSync as readFileSync9, readdirSync as readdirSync3, readlinkSync } from "fs";
 import { setTimeout as wait } from "timers/promises";
 var SIGTERM_GRACE_MS = 1500;
 var IS_WIN = process.platform === "win32";
+function pickKillPort(opts) {
+  if (opts.explicit != null) return opts.explicit;
+  if (opts.worktree != null) return opts.worktree;
+  if (opts.env != null) return opts.env;
+  return opts.appLaunch ?? DEFAULT_PORT;
+}
 var kill_default = defineCommand4({
   meta: {
     name: "kill",
@@ -1754,21 +1978,38 @@ var kill_default = defineCommand4({
     }
   },
   async run({ args }) {
-    const port = (args.port ? null : resolveWorktreePort(process.cwd())) ?? resolvePort(args.port);
+    const cwd = process.cwd();
+    const port = pickKillPort({
+      explicit: args.port ? resolvePort(args.port) : null,
+      worktree: resolveWorktreePort(cwd),
+      // resolvePort() reads + validates $DEEPSPACE_PORT; only consult it when set.
+      env: process.env.DEEPSPACE_PORT ? resolvePort() : null,
+      appLaunch: resolveAppLaunchPort(findAppDir(cwd) ?? cwd)
+    });
     const targets = /* @__PURE__ */ new Set();
-    for (const pid of listenerPids(port)) targets.add(pid);
+    const listeners = enumerateListeners(port);
+    for (const pid of listeners.pids) targets.add(pid);
     for (const pid of [...targets]) {
       for (const child of childPids(pid)) targets.add(child);
     }
+    let swept = false;
     if (args.all) {
-      for (const pid of processPidsByName(["workerd", "wrangler", "vite"])) {
-        targets.add(pid);
-      }
+      const sweep = sweepByName(["workerd", "wrangler", "vite"]);
+      swept = sweep.swept;
+      for (const pid of sweep.pids) targets.add(pid);
     }
     if (targets.size === 0) {
-      console.log(
-        args.all ? `Nothing listening on :${port} and no stray workerd/wrangler/vite processes found.` : `Nothing listening on :${port}. (Pass --all to sweep stray workerd/wrangler.)`
-      );
+      const outcome = noTargetsMessage({
+        enumerated: listeners.enumerated,
+        swept,
+        all: args.all,
+        port
+      });
+      if (!outcome.ok) {
+        console.error(outcome.message);
+        process.exit(1);
+      }
+      console.log(outcome.message);
       return;
     }
     for (const pid of targets) {
@@ -1794,37 +2035,74 @@ var kill_default = defineCommand4({
       );
       process.exit(1);
     }
-    console.log(`Port ${port} is free.`);
+    if (args.all) {
+      console.log(`Killed ${targets.size} process(es) (workerd/wrangler/vite sweep). :${port} is free.`);
+    } else {
+      console.log(`Port ${port} is free.`);
+    }
   }
 });
-function listenerPids(port) {
+function noTargetsMessage(opts) {
+  const { enumerated, swept, all, port } = opts;
+  const couldObserve = enumerated || all && swept;
+  if (!couldObserve) {
+    return {
+      ok: false,
+      message: `Couldn't determine what's running on :${port}: no lsof/pgrep and /proc is unavailable, so nothing was inspected or killed. Install lsof (or procps for pgrep), or find and kill the process manually.`
+    };
+  }
+  return {
+    ok: true,
+    message: all ? `Nothing listening on :${port} and no stray workerd/wrangler/vite processes found.` : `Nothing listening on :${port}. (Pass --all to sweep stray workerd/wrangler.)`
+  };
+}
+function enumerateListeners(port) {
   if (IS_WIN) {
-    return runPowershell(
+    const r = runPowershellChecked(
       `Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess`
     );
+    return { pids: r.pids, enumerated: r.ran };
+  }
+  const lsof = runLsof(port);
+  if (lsof.ran) return { pids: lsof.pids, enumerated: true };
+  const proc = listenerPidsViaProc(port);
+  return { pids: proc.pids, enumerated: proc.available };
+}
+function listenerPids(port) {
+  return enumerateListeners(port).pids;
+}
+function runLsof(port) {
+  try {
+    const r = spawnSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
+      encoding: "utf-8"
+    });
+    if (r.error) return { pids: [], ran: false };
+    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: true };
+  } catch {
+    return { pids: [], ran: false };
   }
-  const viaLsof = run(["lsof", "-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"]);
-  if (viaLsof.length) return viaLsof;
-  return listenerPidsViaProc(port);
 }
 function listenerPidsViaProc(port) {
+  let available = false;
   try {
     const hexPort = port.toString(16).toUpperCase().padStart(4, "0");
     const inodes = /* @__PURE__ */ new Set();
     for (const f of ["/proc/net/tcp", "/proc/net/tcp6"]) {
       let data;
       try {
-        data = readFileSync8(f, "utf-8");
+        data = readFileSync9(f, "utf-8");
       } catch {
         continue;
       }
+      available = true;
       for (const line of data.split("\n").slice(1)) {
         const cols = line.trim().split(/\s+/);
         if (cols[3] !== "0A") continue;
         if (cols[1]?.split(":")[1] === hexPort && cols[9]) inodes.add(cols[9]);
       }
     }
-    if (!inodes.size) return [];
+    if (!available) return { pids: [], available: false };
+    if (!inodes.size) return { pids: [], available: true };
     const pids = /* @__PURE__ */ new Set();
     for (const pidDir of readdirSync3("/proc")) {
       if (!/^\d+$/.test(pidDir)) continue;
@@ -1848,9 +2126,9 @@ function listenerPidsViaProc(port) {
         }
       }
     }
-    return [...pids];
+    return { pids: [...pids], available: true };
   } catch {
-    return [];
+    return { pids: [], available };
   }
 }
 function childPids(parentPid) {
@@ -1861,22 +2139,31 @@ function childPids(parentPid) {
   }
   return run(["pgrep", "-P", String(parentPid)]);
 }
-function processPidsByName(names) {
+function sweepByName(names) {
   const all = /* @__PURE__ */ new Set();
   if (IS_WIN) {
     const orClauses = names.map((n) => `($_.Name -like '*${n}*') -or ($_.CommandLine -like '*${n}*')`).join(" -or ");
     const script = `Get-CimInstance Win32_Process | Where-Object { ${orClauses} } | Select-Object -ExpandProperty ProcessId`;
-    for (const pid of runPowershell(script)) {
-      if (pid !== process.pid) all.add(pid);
-    }
-    return [...all];
+    const r = runPowershellChecked(script);
+    for (const pid of r.pids) if (pid !== process.pid) all.add(pid);
+    return { pids: [...all], swept: r.ran };
   }
+  let swept = false;
   for (const name of names) {
-    for (const pid of run(["pgrep", "-f", name])) {
-      if (pid !== process.pid) all.add(pid);
-    }
+    const r = runPgrep(["-f", name]);
+    if (r.ran) swept = true;
+    for (const pid of r.pids) if (pid !== process.pid) all.add(pid);
+  }
+  return { pids: [...all], swept };
+}
+function runPgrep(pgrepArgs) {
+  try {
+    const r = spawnSync("pgrep", pgrepArgs, { encoding: "utf-8" });
+    if (r.error) return { pids: [], ran: false };
+    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 || r.status === 1 };
+  } catch {
+    return { pids: [], ran: false };
   }
-  return [...all];
 }
 function run(cmd) {
   try {
@@ -1888,15 +2175,18 @@ function run(cmd) {
   }
 }
 function runPowershell(script) {
+  return runPowershellChecked(script).pids;
+}
+function runPowershellChecked(script) {
   const exe = pwshOrPowershell();
   try {
     const r = spawnSync(exe, ["-NoProfile", "-NonInteractive", "-Command", script], {
       encoding: "utf-8"
     });
-    if (r.status !== 0) return [];
-    return parsePidLines(r.stdout);
+    if (r.error) return { pids: [], ran: false };
+    return { pids: r.status === 0 ? parsePidLines(r.stdout) : [], ran: r.status === 0 };
   } catch {
-    return [];
+    return { pids: [], ran: false };
   }
 }
 function pwshOrPowershell() {
@@ -1975,6 +2265,7 @@ var test_default = defineCommand5({
     },
     env: {
       type: "string",
+      alias: "e",
       description: "wrangler.toml [env.<name>] block to test (uses secrets config <name> by default).",
       required: false
     }
@@ -2010,8 +2301,8 @@ var test_default = defineCommand5({
       token = await ensureToken();
       const payload = decodeJwtPayload(token);
       ownerId = payload.sub;
-    } catch {
-      console.error("`deepspace test` requires you to be logged in. Run `deepspace login` first.");
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : "Not logged in. Run `deepspace login` first.");
       process.exit(1);
     }
     let generatedSecretsCache;
@@ -2172,7 +2463,7 @@ var screenshot_default = defineCommand6({
 // src/cli/commands/test-accounts.ts
 import { defineCommand as defineCommand7 } from "citty";
 import * as p3 from "@clack/prompts";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync8, existsSync as existsSync9, mkdirSync as mkdirSync4 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir4 } from "os";
 var SESSION_COOKIE2 = "__Secure-better-auth.session_token";
@@ -2182,7 +2473,7 @@ var ACCOUNTS_PATH = join10(DIR3, "test-accounts.json");
 function loadAccounts() {
   if (!existsSync9(ACCOUNTS_PATH)) return [];
   try {
-    return JSON.parse(readFileSync9(ACCOUNTS_PATH, "utf-8"));
+    return JSON.parse(readFileSync10(ACCOUNTS_PATH, "utf-8"));
   } catch {
     return [];
   }
@@ -2192,7 +2483,7 @@ function saveAccounts(accounts) {
   writeFileSync8(ACCOUNTS_PATH, JSON.stringify(accounts, null, 2), { mode: 384 });
 }
 function sessionCookie() {
-  const token = readFileSync9(SESSION_PATH2, "utf-8").trim();
+  const token = readFileSync10(SESSION_PATH2, "utf-8").trim();
   return `${SESSION_COOKIE2}=${encodeURIComponent(token)}`;
 }
 async function fetchRemoteAccounts() {
@@ -2462,7 +2753,7 @@ var test_accounts_default = defineCommand7({
 import { defineCommand as defineCommand8 } from "citty";
 import { execSync as execSync2 } from "child_process";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync10, readdirSync as readdirSync4, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync4, existsSync as existsSync10 } from "fs";
 import { join as join11, resolve as resolve7, dirname as dirname2 } from "path";
 import { pathToFileURL } from "url";
 import * as p4 from "@clack/prompts";
@@ -2519,6 +2810,13 @@ var GROUP_BYTES = (() => {
   const v = Number.isInteger(raw) && raw > 0 ? raw : 3 * 1024 * 1024;
   return Math.min(v, MAX_GROUP_BYTES);
 })();
+function classifyDevVarsSecrets(opts) {
+  const store = new Set(opts.storeSecretNames);
+  const strayKeys = opts.handEditedDevVarKeys.filter((k) => !store.has(k));
+  if (strayKeys.length === 0) return { kind: "ok" };
+  if (opts.storeSecretNames.length === 0 && !opts.allowMissing) return { kind: "block", strayKeys };
+  return { kind: "warn", strayKeys };
+}
 function packAssetGroups(assets, maxBytes) {
   const groups = [];
   let current = [];
@@ -2582,6 +2880,7 @@ var deploy_default = defineCommand8({
     },
     env: {
       type: "string",
+      alias: "e",
       description: "wrangler.toml [env.<name>] block to deploy (e.g. --env staging). Omit to deploy the top-level config.",
       required: false
     },
@@ -2589,6 +2888,11 @@ var deploy_default = defineCommand8({
       type: "boolean",
       description: "Confirm that a changed wrangler `name` renames this app (its URL moves; data, secrets, and collaborators travel). Without this flag an interactive prompt asks.",
       default: false
+    },
+    "allow-missing-secrets": {
+      type: "boolean",
+      description: "Deploy even though hand-edited .dev.vars secrets are absent from the store (they will NOT be deployed, and any a previous deploy set are dropped).",
+      default: false
     }
   },
   async run({ args }) {
@@ -2638,7 +2942,7 @@ var deploy_default = defineCommand8({
     p4.log.info(`Id: ${appId}`);
     const readCustomDevVarsAt = (path) => {
       if (!existsSync10(path)) return {};
-      const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync10(path, "utf-8")));
+      const section = extractCustomDevVars(stripGeneratedSecretsCache(readFileSync11(path, "utf-8")));
       if (!section) return {};
       try {
         return parseDevVars(section);
@@ -2703,13 +3007,13 @@ var deploy_default = defineCommand8({
       p4.cancel("Build output config not found at .wrangler/deploy/config.json");
       process.exit(1);
     }
-    const deployConfig = JSON.parse(readFileSync10(deployConfigPath, "utf-8"));
+    const deployConfig = JSON.parse(readFileSync11(deployConfigPath, "utf-8"));
     const outputWranglerPath = resolve7(dirname2(deployConfigPath), deployConfig.configPath);
     if (!existsSync10(outputWranglerPath)) {
       p4.cancel(`Output wrangler.json not found at ${outputWranglerPath}`);
       process.exit(1);
     }
-    const outputConfig = JSON.parse(readFileSync10(outputWranglerPath, "utf-8"));
+    const outputConfig = JSON.parse(readFileSync11(outputWranglerPath, "utf-8"));
     if (outputConfig.name && outputConfig.name !== appName) {
       const envHint = envName ? ` (--env ${envName})` : "";
       p4.cancel(
@@ -2731,7 +3035,7 @@ var deploy_default = defineCommand8({
     s.start("Collecting assets...");
     const assets = collectAssets(clientDir);
     s.stop(`Collected ${assets.length} assets`);
-    const workerJs = readFileSync10(workerBundlePath, "utf-8");
+    const workerJs = readFileSync11(workerBundlePath, "utf-8");
     const doBindings = outputConfig.durable_objects?.bindings;
     const sqliteClasses = new Set(
       outputConfig.migrations?.flatMap(
@@ -2765,10 +3069,27 @@ var deploy_default = defineCommand8({
     });
     const userSecrets = linkedSecrets ? { ...linkedSecrets.values } : {};
     const handEditedDevVars = linkedSecrets ? localOnlyDevVars : readCustomDevVarsAt(devVarsPath);
-    const strayDevVars = Object.keys(handEditedDevVars).filter((k) => !(k in userSecrets));
-    if (strayDevVars.length) {
+    const secretsDecision = classifyDevVarsSecrets({
+      storeSecretNames: Object.keys(userSecrets),
+      handEditedDevVarKeys: Object.keys(handEditedDevVars),
+      allowMissing: Boolean(args["allow-missing-secrets"])
+    });
+    if (secretsDecision.kind === "block") {
+      const uploadCmd = envName ? `deepspace secrets upload .dev.vars -e ${envName}` : "deepspace secrets upload .dev.vars";
+      const keys = secretsDecision.strayKeys.join(", ");
+      p4.cancel(
+        `Refusing to deploy: the app store has no secrets, but .dev.vars has ${keys}.
+Deploying now would ship the app with no secrets \u2014 replacing any a previous deploy set (they would be dropped from production).
+Upload them to the store first:
+  ${uploadCmd}
+then redeploy. (Pass --allow-missing-secrets to deploy without them.)`
+      );
+      process.exit(1);
+    }
+    if (secretsDecision.kind === "warn") {
+      const stray = secretsDecision.strayKeys;
       p4.log.warn(
-        `.dev.vars has ${strayDevVars.join(", ")} not in the app store \u2014 ${strayDevVars.length === 1 ? "it is" : "they are"} NOT deployed. \`.dev.vars\` is a local dev cache, not deploy config. Move ${strayDevVars.length === 1 ? "it" : "them"} into the store with \`deepspace secrets set KEY=value\` (or \`deepspace secrets upload .dev.vars\`), then redeploy.`
+        `.dev.vars has ${stray.join(", ")} not in the app store \u2014 ${stray.length === 1 ? "it is" : "they are"} NOT deployed. \`.dev.vars\` is a local dev cache, not deploy config. Move ${stray.length === 1 ? "it" : "them"} into the store with \`deepspace secrets set KEY=value\` (or \`deepspace secrets upload .dev.vars\`), then redeploy.`
       );
     }
     const userSecretNames = Object.keys(userSecrets);
@@ -2866,6 +3187,7 @@ var deploy_default = defineCommand8({
       if (userSecretNames.length) {
         form.append("userSecrets", JSON.stringify(userSecrets));
       }
+      form.append("secretsAuthoritative", "true");
       if (extraRoutes.length) {
         form.append("extraRunWorkerFirst", JSON.stringify(extraRoutes));
       }
@@ -2895,6 +3217,12 @@ var deploy_default = defineCommand8({
     let body = await res.json().catch(() => ({}));
     if (res.status === 409 && body.code === "rename_required" && !confirmRename) {
       s.stop("Rename confirmation needed");
+      if (!process.stdin.isTTY) {
+        await bailDeploy(
+          `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. Confirmation needs an interactive terminal \u2014 re-run with --rename to approve the rename, or \`deepspace init --new-id\` if you meant a separate app.`,
+          null
+        );
+      }
       const yes = await p4.confirm({
         message: `This deploy renames the app: ${body.fromHost} \u2192 ${body.toHost}. The URL changes and the old one stops serving right away; data, secrets, and collaborators travel with it. (Meant a separate app? Run \`deepspace init --new-id\` instead.) Rename?`
       });
@@ -3171,7 +3499,7 @@ function collectAssets(dir) {
       } else {
         assets.push({
           path: "/" + rel,
-          contentBase64: readFileSync10(full).toString("base64")
+          contentBase64: readFileSync11(full).toString("base64")
         });
       }
     }
@@ -3192,7 +3520,7 @@ var undeploy_default = defineCommand9({
   args: {
     name: {
       type: "positional",
-      description: "App id to undeploy (reads DEEPSPACE_APP_ID from wrangler.toml if omitted)",
+      description: "App id or subdomain name to undeploy (reads DEEPSPACE_APP_ID from wrangler.toml if omitted)",
       required: false
     },
     env: {
@@ -3203,18 +3531,6 @@ var undeploy_default = defineCommand9({
   },
   async run({ args }) {
     const envName = typeof args.env === "string" && args.env.trim() ? args.env.trim() : void 0;
-    let appId = args.name;
-    if (appId && !APP_ID_RE.test(appId)) {
-      p5.cancel(`"${appId}" is not an app id (app_\u2026). Undeploy targets the id \u2014 run from the app directory, or find it in wrangler.toml.`);
-      process.exit(1);
-    }
-    if (!appId && hasWranglerConfig(process.cwd())) {
-      appId = readAppId(process.cwd(), envName) ?? void 0;
-    }
-    if (!appId) {
-      p5.cancel("Provide an app id or run from a DeepSpace app directory with a DEEPSPACE_APP_ID.");
-      process.exit(1);
-    }
     let token;
     try {
       token = await ensureToken();
@@ -3222,6 +3538,22 @@ var undeploy_default = defineCommand9({
       p5.cancel(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
+    let appId;
+    const positional = typeof args.name === "string" && args.name.trim() ? args.name.trim() : void 0;
+    if (positional) {
+      try {
+        appId = await resolveAppSelector(DEPLOY_URL4, token, positional);
+      } catch (err) {
+        p5.cancel(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
+    } else if (hasWranglerConfig(process.cwd())) {
+      appId = readAppId(process.cwd(), envName) ?? void 0;
+    }
+    if (!appId) {
+      p5.cancel("Provide an app id or subdomain name, or run from a DeepSpace app directory with a DEEPSPACE_APP_ID.");
+      process.exit(1);
+    }
     p5.intro(`Undeploying ${appId}`);
     const s = createSpinner();
     s.start("Removing...");
@@ -3258,24 +3590,28 @@ var whoami_default = defineCommand10({
     }
   },
   async run({ args }) {
+    const failLoggedOut = (msg) => {
+      if (args.json) console.log(JSON.stringify({ loggedIn: false, error: msg }));
+      else console.error(msg);
+      process.exit(1);
+    };
     let jwt;
     try {
       jwt = await ensureToken();
     } catch (err) {
-      console.error(err instanceof Error ? err.message : "Not signed in. Run `deepspace login`.");
-      process.exit(1);
+      failLoggedOut(err instanceof Error ? err.message : "Not logged in. Run `deepspace login` first.");
     }
     let payload;
     try {
       payload = decodeJwtPayload(jwt);
     } catch {
-      console.error("Malformed session token. Run `deepspace login` again.");
-      process.exit(1);
+      failLoggedOut("Malformed session token. Run `deepspace login` again.");
     }
     const isTestAccount = !!payload.email?.endsWith("@deepspace.test");
     const accountType = isTestAccount ? "test-account" : payload.email ? "developer" : "unknown";
     if (args.json) {
       console.log(JSON.stringify({
+        loggedIn: true,
         name: payload.name ?? null,
         email: payload.email ?? null,
         userId: payload.sub ?? null,
@@ -3299,11 +3635,48 @@ var whoami_default = defineCommand10({
   }
 });
 
-// src/cli/commands/add.ts
+// src/cli/commands/apps.ts
 import { defineCommand as defineCommand11 } from "citty";
-import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve8, join as join12 } from "path";
-import { execSync as execSync3 } from "child_process";
+var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var apps_default = defineCommand11({
+  meta: {
+    name: "apps",
+    description: "List your apps (deployed and registered)"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Emit JSON instead of human output",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const token = await ensureToken();
+    const { apps } = await apiFetch(DEPLOY_URL5, token, "/api/apps");
+    if (args.json) {
+      process.stdout.write(JSON.stringify(apps, null, 2) + "\n");
+      return;
+    }
+    if (!apps.length) {
+      console.log("No apps yet. Create one with `npx create-deepspace <name>` and `deepspace deploy`.");
+      return;
+    }
+    const nameWidth = Math.max(4, ...apps.map((a) => (a.name ?? "\u2014").length));
+    const idWidth = Math.max(6, ...apps.map((a) => a.appId.length));
+    console.log(`${"NAME".padEnd(nameWidth)}  ${"APP ID".padEnd(idWidth)}  URL`);
+    for (const a of apps) {
+      const url = a.url ?? "(not deployed)";
+      console.log(`${(a.name ?? "\u2014").padEnd(nameWidth)}  ${a.appId.padEnd(idWidth)}  ${url}`);
+    }
+  }
+});
+
+// src/cli/commands/add.ts
+import { defineCommand as defineCommand12 } from "citty";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve8, join as join12, dirname as dirname3 } from "path";
+import { fileURLToPath } from "url";
+import { spawnSync as spawnSync5 } from "child_process";
 function findScript(from) {
   const inNodeModules = join12(from, "node_modules", "deepspace", "scripts", "add-feature.cjs");
   if (existsSync11(inNodeModules)) return inNodeModules;
@@ -3311,7 +3684,31 @@ function findScript(from) {
   if (existsSync11(inDotDeepspace)) return inDotDeepspace;
   return null;
 }
-var add_default = defineCommand11({
+function runningScript() {
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const script = join12(here, "..", "scripts", "add-feature.cjs");
+  return existsSync11(script) ? script : null;
+}
+function isDeepSpaceApp(dir) {
+  if (existsSync11(join12(dir, "wrangler.toml"))) return true;
+  const pkgPath = join12(dir, "package.json");
+  if (!existsSync11(pkgPath)) return false;
+  try {
+    const pkg2 = JSON.parse(readFileSync12(pkgPath, "utf-8"));
+    return Boolean(pkg2.dependencies?.deepspace || pkg2.devDependencies?.deepspace);
+  } catch {
+    return false;
+  }
+}
+function runInstaller(script, passArgs, cwd) {
+  const res = spawnSync5(process.execPath, [script, ...passArgs], { stdio: "inherit", cwd });
+  if (res.error) {
+    console.error(`Could not run the feature installer: ${res.error.message}`);
+    process.exit(1);
+  }
+  process.exit(res.status ?? 1);
+}
+var add_default = defineCommand12({
   meta: {
     name: "add",
     description: "Add a feature to your DeepSpace app"
@@ -3328,6 +3725,11 @@ var add_default = defineCommand11({
       description: "Show details about a feature",
       required: false
     },
+    install: {
+      type: "boolean",
+      description: "Run your package manager after adding dependencies",
+      required: false
+    },
     feature: {
       type: "positional",
       description: "Feature to install",
@@ -3341,6 +3743,27 @@ var add_default = defineCommand11({
   },
   run({ args }) {
     const appDir = resolve8(args.dir ?? ".");
+    if (args.list || args.info || !args.feature) {
+      const script2 = runningScript();
+      if (!script2) {
+        console.error("Could not find the deepspace feature catalog.");
+        console.error("Reinstall deepspace (`npm i -g deepspace`) or run inside a DeepSpace app.");
+        process.exit(1);
+      }
+      const passArgs2 = args.list ? ["--list"] : args.info ? ["--info", String(args.info)] : ["--help"];
+      runInstaller(script2, passArgs2, process.cwd());
+    }
+    if (!existsSync11(appDir)) {
+      console.error(`Target directory not found: ${appDir}`);
+      console.error("Create a new app first: deepspace create <name>");
+      process.exit(1);
+    }
+    if (!isDeepSpaceApp(appDir)) {
+      console.error(`Not a DeepSpace app: ${appDir}`);
+      console.error('(no wrangler.toml and no "deepspace" dependency found)');
+      console.error("Create one with: deepspace create <name>");
+      process.exit(1);
+    }
     ensureInstallReady(appDir);
     const script = findScript(appDir);
     if (!script) {
@@ -3351,136 +3774,14 @@ var add_default = defineCommand11({
       console.error("Are you in a DeepSpace app directory? Try `npm install` first.");
       process.exit(1);
     }
-    const passArgs = [];
-    if (args.list) {
-      passArgs.push("--list");
-    } else if (args.info) {
-      passArgs.push("--info", args.info);
-    } else if (args.feature) {
-      passArgs.push(args.feature, appDir);
-    } else {
-      passArgs.push("--help");
-    }
-    execSync3(`node ${JSON.stringify(script)} ${passArgs.map((a) => JSON.stringify(a)).join(" ")}`, {
-      stdio: "inherit",
-      cwd: appDir
-    });
-  }
-});
-
-// src/cli/commands/skills.ts
-import { defineCommand as defineCommand12 } from "citty";
-import spawn2 from "cross-spawn";
-import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join13 } from "path";
-import { homedir as homedir5 } from "os";
-var SKILL_REPO = "deepdotspace/deepspace-skill";
-function runSkillsAdd(extraArgs) {
-  return new Promise((resolve10) => {
-    const child = spawn2(
-      "npx",
-      ["-y", "skills@latest", "add", SKILL_REPO, ...extraArgs],
-      { stdio: "inherit" }
-    );
-    child.on("close", (code) => resolve10(code ?? 1));
-    child.on("error", (err) => {
-      console.error(`Failed to invoke npx: ${err.message}`);
-      console.error("Is Node.js installed and on PATH?");
-      resolve10(1);
-    });
-  });
-}
-function precreateClaudeDir(baseDir) {
-  mkdirSync5(join13(baseDir, ".claude"), { recursive: true });
-}
-var add = defineCommand12({
-  meta: {
-    name: "add",
-    description: "Install the DeepSpace skill for your coding agent"
-  },
-  args: {
-    global: {
-      type: "boolean",
-      alias: "g",
-      description: "Install globally (~/.agents/skills/) instead of into the current directory",
-      default: false
-    },
-    yes: {
-      type: "boolean",
-      alias: "y",
-      description: "Skip prompts (assume yes for any confirmation)",
-      default: false
-    },
-    agent: {
-      type: "string",
-      description: "Target a single agent (e.g. claude-code, codex, opencode). Default: install for all detected agents.",
-      required: false
-    }
-  },
-  async run({ args }) {
-    const extra = [];
-    if (args.global) extra.push("-g");
-    if (args.yes) extra.push("-y");
-    if (args.agent) extra.push("--agent", args.agent);
-    if (!args.agent || args.agent === "claude-code") {
-      const baseDir = args.global ? homedir5() : process.cwd();
-      try {
-        precreateClaudeDir(baseDir);
-      } catch (err) {
-        console.warn(`
-  Note: could not pre-create .claude/ for Claude Code: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    }
-    const code = await runSkillsAdd(extra);
-    if (code !== 0) process.exit(code);
-  }
-});
-var skills_default = defineCommand12({
-  meta: {
-    name: "skills",
-    description: "Manage the DeepSpace agent skill (Claude Code, Codex, OpenCode, Cursor, ...)"
-  },
-  subCommands: {
-    add
+    const passArgs = [args.feature, appDir];
+    if (args.install) passArgs.push("--install");
+    runInstaller(script, passArgs, appDir);
   }
 });
 
 // src/cli/commands/domain.ts
 import { defineCommand as defineCommand13 } from "citty";
-
-// src/cli/lib/api.ts
-var ApiError = class extends Error {
-  constructor(message, status3, code) {
-    super(message);
-    this.status = status3;
-    this.code = code;
-  }
-};
-async function apiFetch(baseUrl, token, path, init) {
-  const res = await fetch(`${baseUrl}${path}`, {
-    ...init,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
-      ...init?.headers ?? {}
-    }
-  });
-  const text2 = await res.text();
-  if (!res.ok) {
-    let msg = text2;
-    let code;
-    try {
-      const body = JSON.parse(text2);
-      msg = body.error ?? text2;
-      code = body.code;
-    } catch {
-    }
-    throw new ApiError(`API ${path} (${res.status}): ${msg}`, res.status, code);
-  }
-  return text2 ? JSON.parse(text2) : {};
-}
-
-// src/cli/commands/domain.ts
 var API_URL3 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var api = (token, path, init) => apiFetch(API_URL3, token, path, init);
 function scrubInternal(value) {
@@ -3817,18 +4118,19 @@ function isTestAccountEmail(email) {
 
 // src/cli/commands/collaborators.ts
 var API_URL4 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
+var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 function api2(token, path, init) {
   return apiFetch(API_URL4, token, path, init);
 }
 var list3 = defineCommand14({
   meta: { name: "list", description: "List collaborators on your app" },
   args: {
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL6, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`
@@ -3841,12 +4143,13 @@ var list3 = defineCommand14({
       console.log(`No collaborators on ${app}. Add one with \`deepspace collaborators add <email>\`.`);
       return;
     }
+    console.log(`COLLABORATORS ON ${app}`);
     for (const c of collaborators) {
-      console.log(`${c.emailDisplay.padEnd(32)} ${c.userId}`);
+      console.log(`  ${c.emailDisplay}`);
     }
   }
 });
-var add2 = defineCommand14({
+var add = defineCommand14({
   meta: { name: "add", description: "Authorize a DeepSpace user to deploy your app" },
   args: {
     email: {
@@ -3854,12 +4157,12 @@ var add2 = defineCommand14({
       description: "Collaborator email (must already be a DeepSpace user)",
       required: true
     },
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL6, token, args.app);
     if (isTestAccountEmail(args.email)) {
       console.error(
         "Test accounts (@deepspace.test) cannot be added as collaborators. Use a real DeepSpace account."
@@ -3882,12 +4185,12 @@ var remove = defineCommand14({
   meta: { name: "remove", description: "Remove a collaborator from your app" },
   args: {
     email: { type: "positional", description: "Collaborator email", required: true },
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" },
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
     json: { type: "boolean", description: "Emit JSON" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL6, token, args.app);
     const { collaborators } = await api2(
       token,
       `/api/app-collaborators/${encodeURIComponent(app)}`
@@ -3912,28 +4215,57 @@ var remove = defineCommand14({
 });
 var collaborators_default = defineCommand14({
   meta: { name: "collaborators", description: "Manage who can deploy your app" },
-  subCommands: { list: list3, add: add2, remove }
+  subCommands: { list: list3, add, remove }
 });
 
 // src/cli/commands/transfer.ts
 import { defineCommand as defineCommand15 } from "citty";
+import * as p6 from "@clack/prompts";
 var API_URL5 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
-var DEPLOY_URL5 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+var DEPLOY_URL7 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var offer = defineCommand15({
   meta: { name: "offer", description: "Offer this app to another DeepSpace user" },
   args: {
     email: { type: "positional", description: "Recipient email", required: true },
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" },
+    replace: {
+      type: "boolean",
+      description: "Replace a pending offer to someone else without asking"
+    }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL7, token, args.app);
+    const pending = await apiFetch(
+      API_URL5,
+      token,
+      `/api/app-transfers/${encodeURIComponent(app)}`
+    );
+    const pendingTo = pending.transfer?.toEmailDisplay;
+    if (pendingTo && pendingTo.toLowerCase() !== args.email.trim().toLowerCase() && !args.replace) {
+      if (!process.stdin.isTTY) {
+        console.error(
+          `A pending offer to ${pendingTo} already exists for ${app}. Re-run with --replace to replace it, or \`deepspace transfer cancel\` first.`
+        );
+        process.exit(1);
+      }
+      const yes = await p6.confirm({
+        message: `A pending offer to ${pendingTo} exists \u2014 replace it with ${args.email}?`
+      });
+      if (p6.isCancel(yes) || !yes) {
+        console.log(`Kept the pending offer to ${pendingTo}.`);
+        process.exit(1);
+      }
+    }
     const { expiresAt } = await apiFetch(
       API_URL5,
       token,
       `/api/app-transfers/${encodeURIComponent(app)}`,
       { method: "POST", body: JSON.stringify({ email: args.email }) }
     );
+    if (pendingTo && pendingTo.toLowerCase() !== args.email.trim().toLowerCase()) {
+      console.log(`\u25B2 Replaced the pending offer to ${pendingTo}.`);
+    }
     console.log(
       `\u2713 Offered ${app} to ${args.email} (expires ${expiresAt}).
   They accept with: deepspace transfer accept --app ${app}`
@@ -3943,11 +4275,11 @@ var offer = defineCommand15({
 var status2 = defineCommand15({
   meta: { name: "status", description: "Show the pending transfer offer, if any" },
   args: {
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL7, token, args.app);
     const { transfer } = await apiFetch(API_URL5, token, `/api/app-transfers/${encodeURIComponent(app)}`);
     if (!transfer) {
       console.log(`No pending transfer for ${app}.`);
@@ -3964,7 +4296,7 @@ var accept = defineCommand15({
   async run({ args }) {
     const token = await ensureToken();
     const app = requireAppIdArg(args.app);
-    await apiFetch(DEPLOY_URL5, token, `/api/apps/${encodeURIComponent(app)}/transfer/accept`, {
+    await apiFetch(DEPLOY_URL7, token, `/api/apps/${encodeURIComponent(app)}/transfer/accept`, {
       method: "POST"
     });
     console.log(
@@ -3975,11 +4307,11 @@ var accept = defineCommand15({
 var cancel4 = defineCommand15({
   meta: { name: "cancel", description: "Cancel/decline the pending offer (either party)" },
   args: {
-    app: { type: "string", alias: "a", description: "App id (defaults to ./wrangler.toml)" }
+    app: { type: "string", alias: "a", description: "App id or name (defaults to ./wrangler.toml)" }
   },
   async run({ args }) {
     const token = await ensureToken();
-    const app = requireAppIdArg(args.app);
+    const app = await resolveAppTarget(DEPLOY_URL7, token, args.app);
     await apiFetch(API_URL5, token, `/api/app-transfers/${encodeURIComponent(app)}`, { method: "DELETE" });
     console.log(`\u2713 Transfer offer for ${app} cancelled.`);
   }
@@ -3993,7 +4325,8 @@ var transfer_default = defineCommand15({
 import { defineCommand as defineCommand16 } from "citty";
 
 // src/cli/commands/_invoke-impl.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
+import * as p7 from "@clack/prompts";
 var API_URL6 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var DEFAULT_TIMEOUT_MS = 12e4;
 function parseTarget(target) {
@@ -4018,7 +4351,7 @@ function resolveBody(opts) {
   if (opts.body != null) {
     raw = opts.body;
   } else if (opts.bodyFile != null) {
-    raw = opts.bodyFile === "-" ? readFileSync11(0, "utf-8") : readFileSync11(opts.bodyFile, "utf-8");
+    raw = opts.bodyFile === "-" ? readFileSync13(0, "utf-8") : readFileSync13(opts.bodyFile, "utf-8");
   } else {
     return "{}";
   }
@@ -4052,6 +4385,17 @@ function formatCurrency(value, currency) {
   if (currency === "USD") return `$${value}`;
   return `${value} ${currency}`;
 }
+function billingUnit(model) {
+  if (model === "per_token") return "per token";
+  if (model === "per_call") return "per call";
+  return model.startsWith("per_") ? model.replace(/^per_/, "per ").replace(/_/g, " ") : model;
+}
+function isInteractive(stdin, stdout) {
+  return Boolean(stdin.isTTY && stdout.isTTY);
+}
+function shouldConfirmCost(opts) {
+  return !opts.json && !opts.yes && opts.isTTY && opts.baseCost > 0;
+}
 async function runList(args) {
   const catalog = await fetchCatalog({ summary: true });
   if (args.json) {
@@ -4097,7 +4441,7 @@ async function runInfo(args) {
   }
   console.log(`${integration}/${endpoint}`);
   console.log(
-    `  billing: ${info2.billing.model}, ${formatCurrency(info2.billing.baseCost, info2.billing.currency)} per call`
+    `  billing: ${formatCurrency(info2.billing.baseCost, info2.billing.currency)} ${billingUnit(info2.billing.model)}`
   );
   console.log();
   console.log("Input schema:");
@@ -4112,6 +4456,31 @@ async function runInvoke(args) {
   const { integration, endpoint } = parseTarget(args.target);
   const body = resolveBody({ body: args.body, bodyFile: args.bodyFile });
   const timeoutMs = args.timeout ?? DEFAULT_TIMEOUT_MS;
+  const interactive = isInteractive(process.stdin, process.stdout);
+  if (!args.json && !args.yes && interactive) {
+    let info2 = null;
+    try {
+      info2 = findEndpoint(await fetchCatalog({ summary: true }), integration, endpoint);
+    } catch {
+      console.error("Note: could not verify the call cost; proceeding. Pass --yes to skip this check.");
+      info2 = null;
+    }
+    if (info2 && shouldConfirmCost({
+      json: !!args.json,
+      yes: !!args.yes,
+      isTTY: interactive,
+      baseCost: info2.billing.baseCost
+    })) {
+      const cost = formatCurrency(info2.billing.baseCost, info2.billing.currency);
+      const ok2 = await p7.confirm({
+        message: `${integration}/${endpoint} costs ${cost} ${billingUnit(info2.billing.model)}, billed to your account. Continue?`
+      });
+      if (p7.isCancel(ok2) || !ok2) {
+        p7.cancel("Cancelled \u2014 no call made.");
+        process.exit(0);
+      }
+    }
+  }
   let jwt;
   try {
     jwt = await ensureToken();
@@ -4254,6 +4623,12 @@ var invoke = defineCommand16({
       type: "string",
       description: "Request timeout in milliseconds (default: 120000)",
       required: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the paid-call cost confirmation",
+      default: false
     }
   },
   async run({ args }) {
@@ -4267,7 +4642,8 @@ var invoke = defineCommand16({
         body: args.body,
         bodyFile: args["body-file"],
         json: args.json,
-        timeout
+        timeout,
+        yes: args.yes
       });
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));
@@ -4331,6 +4707,12 @@ var invoke_default = defineCommand17({
       type: "string",
       description: "Request timeout in milliseconds (default: 120000)",
       required: false
+    },
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Skip the paid-call cost confirmation",
+      default: false
     }
   },
   async run({ args }) {
@@ -4352,7 +4734,8 @@ var invoke_default = defineCommand17({
         body: args.body,
         bodyFile: args["body-file"],
         json: args.json,
-        timeout
+        timeout,
+        yes: args.yes
       });
     } catch (err) {
       console.error(err instanceof Error ? err.message : String(err));
@@ -4363,10 +4746,10 @@ var invoke_default = defineCommand17({
 
 // src/cli/commands/library.ts
 import { defineCommand as defineCommand18 } from "citty";
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
-import { join as join14, resolve as resolve9 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
+import { join as join13, resolve as resolve9 } from "path";
 import { parse as parseToml4 } from "smol-toml";
-import * as p6 from "@clack/prompts";
+import * as p8 from "@clack/prompts";
 var DEFAULT_LIBRARY_APP = "deepdotspace-site";
 var publish = defineCommand18({
   meta: {
@@ -4428,25 +4811,25 @@ var publish = defineCommand18({
   async run({ args }) {
     const json = !!args.json;
     const intro6 = (s) => {
-      if (!json) p6.intro(s);
+      if (!json) p8.intro(s);
     };
     const info2 = (s) => {
-      if (!json) p6.log.info(s);
+      if (!json) p8.log.info(s);
     };
     const die = (msg) => {
       if (json) console.error(JSON.stringify({ ok: false, error: msg }));
-      else p6.cancel(msg);
+      else p8.cancel(msg);
       process.exit(1);
     };
     intro6("Publishing to the DeepSpace library");
     let appName = typeof args.app === "string" && args.app.trim() ? args.app.trim() : void 0;
     if (!appName) {
       const appDir = resolve9(typeof args.dir === "string" && args.dir ? args.dir : ".");
-      const wranglerPath = join14(appDir, "wrangler.toml");
+      const wranglerPath = join13(appDir, "wrangler.toml");
       if (!existsSync12(wranglerPath)) {
         return die("No --app provided and no wrangler.toml found. Either pass --app <name> or run from your app's directory.");
       }
-      const cfg = parseToml4(readFileSync12(wranglerPath, "utf-8"));
+      const cfg = parseToml4(readFileSync14(wranglerPath, "utf-8"));
       const nameRes = resolveAppName(cfg.name);
       if (!nameRes.ok) return die(`wrangler.toml: ${nameRes.reason}`);
       appName = nameRes.name;
@@ -4502,9 +4885,9 @@ var publish = defineCommand18({
     if (!parsed.success) {
       return die(parsed.error ?? `Publish failed (HTTP ${res.status}).`);
     }
-    p6.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
-    if (parsed.data?.url) p6.log.message(parsed.data.url);
-    p6.outro("Done");
+    p8.log.success(`Published ${appName} as ${parsed.data?.templateHandle} (v${parsed.data?.version})`);
+    if (parsed.data?.url) p8.log.message(parsed.data.url);
+    p8.outro("Done");
   }
 });
 var unpublish = defineCommand18({
@@ -4533,10 +4916,10 @@ var unpublish = defineCommand18({
     const json = !!args.json;
     const die = (msg) => {
       if (json) console.error(JSON.stringify({ ok: false, error: msg }));
-      else p6.cancel(msg);
+      else p8.cancel(msg);
       process.exit(1);
     };
-    if (!json) p6.intro("Unpublishing library entry");
+    if (!json) p8.intro("Unpublishing library entry");
     let token;
     try {
       token = await ensureToken();
@@ -4562,8 +4945,8 @@ var unpublish = defineCommand18({
       process.exit(parsed.success ? 0 : 1);
     }
     if (!parsed.success) return die(parsed.error ?? `HTTP ${res.status}`);
-    p6.log.success(`Unpublished ${parsed.data?.templateHandle}`);
-    p6.outro("Done");
+    p8.log.success(`Unpublished ${parsed.data?.templateHandle}`);
+    p8.outro("Done");
   }
 });
 var library_default = defineCommand18({
@@ -4579,10 +4962,10 @@ var library_default = defineCommand18({
 
 // src/cli/commands/feedback.ts
 import { defineCommand as defineCommand19 } from "citty";
-import * as p7 from "@clack/prompts";
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
-import { dirname as dirname3, join as join15 } from "path";
-import { fileURLToPath } from "url";
+import * as p9 from "@clack/prompts";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
+import { dirname as dirname4, join as join14 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { release } from "os";
 var API_URL7 = process.env.DEEPSPACE_API_URL ?? PLATFORM_URLS.api;
 var TYPES = ["bug", "feature", "other"];
@@ -4602,14 +4985,14 @@ function normalizeType(raw) {
 }
 function readCliVersion() {
   try {
-    const here = dirname3(fileURLToPath(import.meta.url));
+    const here = dirname4(fileURLToPath2(import.meta.url));
     const candidates = [
-      join15(here, "..", "package.json"),
-      join15(here, "..", "..", "..", "package.json")
+      join14(here, "..", "package.json"),
+      join14(here, "..", "..", "..", "package.json")
     ];
     for (const path of candidates) {
       if (!existsSync13(path)) continue;
-      const pkg2 = JSON.parse(readFileSync13(path, "utf-8"));
+      const pkg2 = JSON.parse(readFileSync15(path, "utf-8"));
       if (pkg2.name === "deepspace" && pkg2.version) return pkg2.version;
     }
   } catch {
@@ -4714,21 +5097,21 @@ var feedback_default = defineCommand19({
       );
     }
     if (interactive && (!args.type || !title || !body)) {
-      p7.intro("DeepSpace Feedback");
+      p9.intro("DeepSpace Feedback");
       if (!args.type) {
-        const picked = await p7.select({
+        const picked = await p9.select({
           message: "What kind of feedback is this?",
           options: TYPES.map((t) => ({ value: t, label: TYPE_LABELS[t] })),
           initialValue: type
         });
-        if (p7.isCancel(picked)) {
-          p7.cancel("Cancelled.");
+        if (p9.isCancel(picked)) {
+          p9.cancel("Cancelled.");
           process.exit(0);
         }
         type = picked;
       }
       if (!title) {
-        const t = await p7.text({
+        const t = await p9.text({
           message: "Title",
           placeholder: "Short summary of the issue",
           validate: (v) => {
@@ -4738,14 +5121,14 @@ var feedback_default = defineCommand19({
             return void 0;
           }
         });
-        if (p7.isCancel(t)) {
-          p7.cancel("Cancelled.");
+        if (p9.isCancel(t)) {
+          p9.cancel("Cancelled.");
           process.exit(0);
         }
         title = String(t);
       }
       if (!body) {
-        const m = await p7.text({
+        const m = await p9.text({
           message: "Details",
           placeholder: "What happened? Steps to reproduce, what you expected\u2026",
           validate: (v) => {
@@ -4755,8 +5138,8 @@ var feedback_default = defineCommand19({
             return void 0;
           }
         });
-        if (p7.isCancel(m)) {
-          p7.cancel("Cancelled.");
+        if (p9.isCancel(m)) {
+          p9.cancel("Cancelled.");
           process.exit(0);
         }
         body = String(m);
@@ -4774,7 +5157,7 @@ var feedback_default = defineCommand19({
       return fail2(err.message);
     }
     if (interactive && !args.yes) {
-      p7.note(
+      p9.note(
         `${TYPE_LABELS[payload.type]}
 ${payload.title}
 
@@ -4783,9 +5166,9 @@ ${payload.body}
 Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payload.platform}` + (payload.appName ? ` \xB7 app ${payload.appName}` : ""),
         "Review"
       );
-      const ok = await p7.confirm({ message: "Send this to the DeepSpace team?" });
-      if (p7.isCancel(ok) || !ok) {
-        p7.cancel("Not sent.");
+      const ok = await p9.confirm({ message: "Send this to the DeepSpace team?" });
+      if (p9.isCancel(ok) || !ok) {
+        p9.cancel("Not sent.");
         process.exit(0);
       }
     }
@@ -4809,7 +5192,7 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
       return;
     }
     if (interactive) {
-      p7.outro(`Thanks! Submitted as ${result.report.id}.`);
+      p9.outro(`Thanks! Submitted as ${result.report.id}.`);
     } else {
       console.log(`Submitted feedback ${result.report.id} (${result.report.type}).`);
     }
@@ -4819,8 +5202,18 @@ Context: deepspace ${payload.cliVersion} \xB7 ${payload.nodeVersion} \xB7 ${payl
 
 // src/cli/commands/secrets.ts
 import { defineCommand as defineCommand20 } from "citty";
-import { readFileSync as readFileSync14 } from "fs";
-var DEPLOY_URL6 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
+import { readFileSync as readFileSync16 } from "fs";
+
+// src/cli/lib/citty-args.ts
+function dedupePositionals(bound, rest) {
+  const restArr = Array.isArray(rest) ? rest : [];
+  return [.../* @__PURE__ */ new Set([bound, ...restArr])].filter(
+    (v) => typeof v === "string" && v.length > 0
+  );
+}
+
+// src/cli/commands/secrets.ts
+var DEPLOY_URL8 = process.env.DEEPSPACE_DEPLOY_URL ?? PLATFORM_URLS.deploy;
 var COMMON_ARGS = {
   app: {
     type: "string",
@@ -4877,6 +5270,7 @@ function warnIfDebugRoutesEnabled(secrets) {
   return true;
 }
 var APPLY_HINT = "Run `deepspace deploy` to apply \u2014 secrets take effect at deploy time.";
+var LOCAL_DEV_HINT = "Running `deepspace dev`? Restart it to load the change locally.";
 var list5 = defineCommand20({
   meta: { name: "list", description: "List masked secrets in a config" },
   args: {
@@ -4891,7 +5285,7 @@ var list5 = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const { secrets } = await listSecrets(DEPLOY_URL8, t.token, t.appId, t.configName);
       if (args.json) {
         console.log(JSON.stringify({ appId: t.appId, config: t.configName, secrets }, null, 2));
         return;
@@ -4917,9 +5311,7 @@ var set = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const pairs = [.../* @__PURE__ */ new Set([args.secret, ...args._ ?? []])].filter(
-        (v) => typeof v === "string" && v.length > 0
-      );
+      const pairs = dedupePositionals(args.secret, args._);
       const secrets = {};
       const dupes = [];
       for (const pair of pairs) {
@@ -4938,12 +5330,15 @@ var set = defineCommand20({
       }
       if (Object.keys(secrets).length === 1) {
         const [[k, v]] = Object.entries(secrets);
-        await setSecret(DEPLOY_URL6, t.token, t.appId, t.configName, k, v);
+        await setSecret(DEPLOY_URL8, t.token, t.appId, t.configName, k, v);
       } else {
-        await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, false);
+        await uploadSecrets(DEPLOY_URL8, t.token, t.appId, t.configName, secrets, false);
       }
       console.log(`Set ${Object.keys(secrets).length} secret${Object.keys(secrets).length === 1 ? "" : "s"} in ${t.configName}.`);
-      if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
+      if (!warnIfDebugRoutesEnabled(secrets)) {
+        console.log(APPLY_HINT);
+        console.log(LOCAL_DEV_HINT);
+      }
     } catch (err) {
       fail(err);
     }
@@ -4961,11 +5356,11 @@ var get = defineCommand20({
       const t = await resolveTarget(args);
       const key = validateSecretName(args.key);
       if (args.plain) {
-        const { value } = await getSecretPlain(DEPLOY_URL6, t.token, t.appId, t.configName, key);
+        const { value } = await getSecretPlain(DEPLOY_URL8, t.token, t.appId, t.configName, key);
         process.stdout.write(process.stdout.isTTY ? value + "\n" : value);
         return;
       }
-      const { secrets } = await listSecrets(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const { secrets } = await listSecrets(DEPLOY_URL8, t.token, t.appId, t.configName);
       const item = secrets.find((s) => s.key === key);
       if (!item) fail(new Error(`Secret "${key}" not found in ${t.configName}`));
       console.log(`${item.key}  (v${item.version}, ${item.updatedAt})`);
@@ -4983,15 +5378,13 @@ var del2 = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const keys = [.../* @__PURE__ */ new Set([args.key, ...args._ ?? []])].filter(
-        (v) => typeof v === "string" && v.length > 0
-      );
+      const keys = dedupePositionals(args.key, args._);
       let deleted = 0;
       let absent = 0;
       for (const key of keys) {
         const name = validateSecretName(key);
         try {
-          await deleteSecret(DEPLOY_URL6, t.token, t.appId, t.configName, name);
+          await deleteSecret(DEPLOY_URL8, t.token, t.appId, t.configName, name);
           deleted++;
         } catch (err) {
           if (err?.status === 404) absent++;
@@ -5020,10 +5413,10 @@ var upload = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const content = args.file === "-" ? readFileSync14(0, "utf-8") : readFileSync14(args.file, "utf-8");
+      const content = args.file === "-" ? readFileSync16(0, "utf-8") : readFileSync16(args.file, "utf-8");
       const secrets = parseSecretsUpload(content);
       if (Object.keys(secrets).length === 0) fail(new Error("No secrets found in the input."));
-      await uploadSecrets(DEPLOY_URL6, t.token, t.appId, t.configName, secrets, args.replace);
+      await uploadSecrets(DEPLOY_URL8, t.token, t.appId, t.configName, secrets, args.replace);
       console.log(`Uploaded ${Object.keys(secrets).length} secrets to ${t.configName}.`);
       if (!warnIfDebugRoutesEnabled(secrets)) console.log(APPLY_HINT);
     } catch (err) {
@@ -5048,7 +5441,7 @@ var download = defineCommand20({
       if (!["dotenv", "json", "shell"].includes(format)) {
         fail(new Error(`Unknown format "${args.format}" \u2014 use dotenv, json, or shell.`));
       }
-      const { secrets } = await fetchSecretsValues(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const { secrets } = await fetchSecretsValues(DEPLOY_URL8, t.token, t.appId, t.configName);
       process.stdout.write(formatSecretsDownload(secrets, format));
     } catch (err) {
       fail(err);
@@ -5065,7 +5458,7 @@ var pull = defineCommand20({
       if (!appDir) fail(new Error("Run from a DeepSpace app directory (one containing wrangler.toml)."));
       const t = await resolveTarget(args);
       const ownerId = decodeJwtPayload(t.token).sub;
-      const pulled = await pullAppSecretsCache(DEPLOY_URL6, t.token, t.appId, t.configName);
+      const pulled = await pullAppSecretsCache(DEPLOY_URL8, t.token, t.appId, t.configName);
       if (!pulled) {
         console.log(`No secrets in ${t.configName} yet \u2014 nothing to pull.`);
         return;
@@ -5089,7 +5482,7 @@ var configsList = defineCommand20({
   async run({ args }) {
     try {
       const t = await resolveTarget(args);
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL6, t.token, t.appId);
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL8, t.token, t.appId);
       if (configs2.length === 0) {
         console.log("No configs yet \u2014 the first `secrets set` creates one.");
         return;
@@ -5114,7 +5507,7 @@ var configsCreate = defineCommand20({
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
       const copyFrom = args["copy-from"] || void 0;
-      const { configs: configs2 } = await listConfigs(DEPLOY_URL6, t.token, t.appId);
+      const { configs: configs2 } = await listConfigs(DEPLOY_URL8, t.token, t.appId);
       if (configs2.some((c) => c.name === name)) {
         if (copyFrom) {
           fail(
@@ -5126,7 +5519,7 @@ var configsCreate = defineCommand20({
         console.log(`Config ${name} already exists.`);
         return;
       }
-      await createConfig(DEPLOY_URL6, t.token, t.appId, name, copyFrom);
+      await createConfig(DEPLOY_URL8, t.token, t.appId, name, copyFrom);
       console.log(`Created ${name}.`);
     } catch (err) {
       fail(err);
@@ -5143,7 +5536,7 @@ var configsDelete = defineCommand20({
     try {
       const t = await resolveTarget(args);
       const name = validateConfigName(args.name);
-      await deleteConfig(DEPLOY_URL6, t.token, t.appId, name);
+      await deleteConfig(DEPLOY_URL8, t.token, t.appId, name);
       console.log(`Deleted ${name}.`);
     } catch (err) {
       fail(err);
@@ -5215,28 +5608,36 @@ var init_default = defineCommand21({
 });
 
 // src/cli/cli.ts
-var __dirname = dirname4(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync15(join16(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname5(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync17(join15(__dirname, "..", "package.json"), "utf-8"));
 if (process.platform === "linux" && !process.env.SSL_CERT_FILE && existsSync14("/etc/ssl/certs/ca-certificates.crt")) {
   process.env.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
 }
 var create2 = defineCommand22({
   meta: {
     name: "create",
-    description: "Create a new DeepSpace app"
+    description: "Create a new DeepSpace app (runs create-deepspace; all flags are forwarded)"
   },
   args: {
     name: {
       type: "positional",
       description: "App name",
       required: false
+    },
+    interactive: {
+      type: "boolean",
+      description: "Prompt for options instead of using defaults"
+    },
+    local: {
+      type: "string",
+      description: "Use a local SDK monorepo checkout instead of the published package"
     }
   },
-  run({ args }) {
-    const name = args.name ? ` ${args.name}` : "";
-    console.log(`Running: npm create deepspace${name}
-`);
-    execSync4(`npm create deepspace@latest${name}`, { stdio: "inherit" });
+  run({ rawArgs }) {
+    const scaffolder = `create-deepspace@${pkg.version}`;
+    console.log(`Running: npx ${scaffolder} ${rawArgs.join(" ")}`.trimEnd() + "\n");
+    const res = spawnSync6("npx", ["-y", scaffolder, ...rawArgs], { stdio: "inherit" });
+    process.exit(res.status ?? 1);
   }
 });
 var main = defineCommand22({
@@ -5251,13 +5652,13 @@ var main = defineCommand22({
     login: login_default,
     logout: logout_default,
     whoami: whoami_default,
+    apps: apps_default,
     dev: dev_default,
     kill: kill_default,
     test: test_default,
     screenshot: screenshot_default,
     "test-accounts": test_accounts_default,
     add: add_default,
-    skills: skills_default,
     integrations: integrations_default,
     invoke: invoke_default,
     deploy: deploy_default,